Detections API¶
Query detections from endpoints, servers, and third-party integrations.
See the guide for a narrative walkthrough of this API.
Base URL¶
https://api-{dataRegion}.central.sophos.com/detections/v1 — Regional service in the production environment.
| Variable | Description | Default | Allowed values |
|---|---|---|---|
dataRegion | The data region where the service is. | eu01 | eu01, eu02, us01, us03, ca01, au01, jp01, in01, br01, ae01 |
Authentication¶
Every request carries an Authorization: Bearer header with an access token obtained through the client-credentials flow — see Get started.
Operations¶
DetectionGroup¶
- Run a groups query
POST/queries/detection-groups - Get group run
GET/queries/detection-groups/{runId} - Get group results
GET/queries/detection-groups/{runId}/results
Detections¶
- Run detections query
POST/queries/detections - Get detection counts
GET/queries/detections/counts - Get detections run
GET/queries/detections/{runId} - Get detection result
GET/queries/detections/{runId}/results
Download¶